improved cryptanalysis of py
play

Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the - PowerPoint PPT Presentation

Py SPP attack Improving on the attack Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the Art in Stream Ciphers 2006 Py SPP attack Improving on the attack Py eSTREAM entrant by Eli Biham and Jennifer Seberry Fast in


  1. Py SPP attack Improving on the attack Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the Art in Stream Ciphers 2006

  2. Py SPP attack Improving on the attack Py ✎ eSTREAM entrant by Eli Biham and Jennifer Seberry ✎ Fast in software (2.6 cycles/byte on some platforms) ✎ SPP attack: 2 88 bytes of output ✎ Our attack: 2 72 bytes

  3. Py SPP attack Improving on the attack Output O 1 P O 2

  4. Py SPP attack Improving on the attack Update P P

  5. Py SPP attack Improving on the attack SPP attack ✎ Gautham Sekar, Souradyuti Paul, Bart Preneel ✎ Defines event L with Pr ❬ L ❪ ✙ 2 � 41 ✿ 91 ✎ When L occurs, two output bits are the same

  6. Py SPP attack Improving on the attack Event L (1) S P S

  7. Py SPP attack Improving on the attack Event L (2) O 1 ❀ 1 A B S A B A B O 2 ❀ 3

  8. Py SPP attack Improving on the attack Result of event L A S B O 1 ❀ 1 O 2 ❀ 3

  9. Py SPP attack Improving on the attack Improving on the attack ✎ Use all bits of O 1 ❀ 1 ❀ O 2 ❀ 3 ✎ Group output by column bitwise ✎ Find exact probability Pr ❬ O 1 ❀ 1 ❀ O 2 ❀ 3 ❂ o 1 ❀ 1 ❀ o 2 ❀ 3 ❥ L ❪ ✎ Apply optimal distinguisher

  10. Py SPP attack Improving on the attack Addition ❬ X ❪ 3 ❬ Y ❪ 3 ❬ X ❪ 2 ❬ Y ❪ 2 ❬ X ❪ 1 ❬ Y ❪ 1 ❬ X ❪ 0 ❬ Y ❪ 0 ❬ c ❪ 0 ❬ c ❪ 3 ❬ c ❪ 2 ❬ c ❪ 1 ❬ X ✰ Y ❪ 3 ❬ X ✰ Y ❪ 2 ❬ X ✰ Y ❪ 1 ❬ X ✰ Y ❪ 0

  11. Py SPP attack Improving on the attack Carry propagation ❬ A ❪ i ❬ S ❪ i ❬ B ❪ i ❬ c 1 ❪ i ✰ 1 ❬ c 1 ❪ i ❬ c 3 ❪ i ✰ 1 ❬ c 3 ❪ i ❬ O 1 ❀ 1 ❪ i ❬ O 2 ❀ 3 ❪ i

  12. Py SPP attack Improving on the attack Carry propagation ❬ A ❪ i ❬ S ❪ i ❬ B ❪ i ❬ c 1 ❪ i ✰ 1 ❬ c 1 ❪ i ❬ c 3 ❪ i ✰ 1 ❬ c 3 ❪ i ❬ O 1 ❀ 1 ❪ i ❬ O 2 ❀ 3 ❪ i

  13. Py SPP attack Improving on the attack Hidden Markov model 1 1 1 8 8 2 1 ❀ 0 1 ❀ 0 0 ❀ 0 0 ❀ 0 1 0 1 0 0 1

  14. Py SPP attack Improving on the attack Hidden Markov model 1 1 1 8 8 2 1 ❀ 0 1 ❀ 0 0 ❀ 0 0 ❀ 0 1 0 1 0 0 1

  15. Py SPP attack Improving on the attack The forward algorithm ✔ 1 ✕ 0 1 Pr ❂ 1 1 ✂ 4 M 1 ❀ 0 M 0 ❀ 0 M 1 ❀ 1 ✙ 0 0 0 1 ✵ ✶ 1 0 ❇ ❈ � ✁ where 1 1 ✂ 4 ❂ 1 1 1 1 and ✙ 0 ❂ ❇ ❈ 0 ❅ ❆ 0

  16. Py SPP attack Improving on the attack Optimal distinguisher ✎ Thomas Baignères, Pascal Junod, Serge Vaudenay ✎ Optimal distinguisher chooses the distribution which has the highest probability of producing the observed output

  17. Py SPP attack Improving on the attack Optimal distinguisher s 0 s 1 s 2

  18. Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2

  19. Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2

  20. Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪

  21. Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪

  22. Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪ Pr ❬ s 0 ❪ Pr ❬ s 1 ❪ Pr ❬ s 2 ❪

  23. Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪ Pr ❬ s 0 ❪ Pr ❬ s 1 ❪ Pr ❬ s 2 ❪ Pr ❬ s 0 ❫ s 1 ❫ s 2 ❪

  24. ✎ ☞ ✎ � �P ✁ ✁ ☞ ❂ ❬ ❪ ❥❩❥ ❬ ❥ ❪ � ✷❩ ✎ ☞ ❂ ❬ ❪ Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥

  25. ✎ � �P ✁ ✁ ☞ ❂ ❬ ❪ ❥❩❥ ❬ ❥ ❪ � ✷❩ ✎ ☞ ❂ ❬ ❪ Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥ ✎ Need around 2 ☞ samples

  26. ✎ ☞ ❂ ❬ ❪ Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥ ✎ Need around 2 ☞ samples ✎ Both distinguishers: ☞ ❂ Pr ❬ L ❪ 2 � z ✷❩ Pr ❬ z ❥ L ❪ 2 ✁ �P ✁ ❥❩❥ � 1

  27. Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥ ✎ Need around 2 ☞ samples ✎ Both distinguishers: ☞ ❂ Pr ❬ L ❪ 2 � z ✷❩ Pr ❬ z ❥ L ❪ 2 ✁ �P ✁ ❥❩❥ � 1 ✎ SPP attack: ☞ ❂ Pr ❬ L ❪ 2 so around 2 85 samples

  28. ❳ ❂ ✭ ✙ ✮ ✿ ✿ ✿ ✂ ❳ ❂ ✭ ✙ ✮ ✭ ✙ ✮ ✿ ✿ ✿ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ✷ ❢ ❀ ❀ ❀ ❀ ❀ ❀ ❀ ❣ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩

  29. ❳ ❂ ✭ ✙ ✮ ✭ ✙ ✮ ✿ ✿ ✿ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

  30. ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ T ❂ M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

  31. ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ T ❂ ❳ ✏ ✑ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✙ T 0 M T 0 ✿ ✿ ✿ M T 30 M T 31 1 T ❂ 1 ✂ 4 M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

  32. Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ T ❂ ❳ ✏ ✑ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✙ T 0 M T 0 ✿ ✿ ✿ M T 30 M T 31 1 T ❂ 1 ✂ 4 ❳ ✏ ✑ M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✙ T 0 M T 0 ✿ ✿ ✿ M T 30 M T 1 T ❂ 1 1 ✂ 4 1 ✂ 4 31 M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

  33. ❂ ✙ ✙ ❳ ❂ ✰ ✷❢ ❀ ❀ ❀ ❀ ❀ ❀ ❀ ❣ ✏ ✏ ✑ ✑ ☞ ❂ ❬ ❪ � ✂ ✂ ✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1

  34. ❳ ❂ ✰ ✷❢ ❀ ❀ ❀ ❀ ❀ ❀ ❀ ❣ ✏ ✏ ✑ ✑ ☞ ❂ ❬ ❪ � ✂ ✂ ✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1 ✙ 0 ✙ T H 0 ❂ 0

  35. ✏ ✏ ✑ ✑ ☞ ❂ ❬ ❪ � ✂ ✂ ✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1 ✙ 0 ✙ T H 0 ❂ 0 ❳ MH i M T H i ✰ 1 ❂ M ✷❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

  36. ✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1 ✙ 0 ✙ T H 0 ❂ 0 ❳ MH i M T H i ✰ 1 ❂ M ✷❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣ Pr ❬ L ❪ 2 ✏ 2 64 ✏ ✑ ✑ 1 1 ✂ 4 H 32 1 T ☞ ❂ � 1 1 ✂ 4

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend